Not all, but most of the extensions (addons) require a set of permissions they must declare to the manifest file. The user is not notified by a security warning unless the extension is installed from a .crx file extension. In this later or other cases, a plugin that requires the user's permissions to run is a security threat.
Similar extensions requiring user's permissions exist in other browsers and it is really a critical issue. Each browser author deals with this problem differently. For example, Mozilla requires from such extensions to be signed and listed in the Addons Mozilla where the addons are regularly scanned for the presence of malware. That helps to prevent but does not protect totally the users.